CVE-2023-4169
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
A critical vulnerability was found in Ruijie RG-EW1200G 1.0(1)B1P5 related to improper access controls in the file /api/sys/set_passwd. An attacker can exploit this vulnerability remotely.
Risk Assessment
The organization is at risk of unauthorized access to the system, which could lead to serious consequences, including data loss or device takeover.
Recommendation
It is recommended to immediately update the device firmware to the latest version to mitigate this vulnerability and monitor the system for unauthorized access attempts.
Original NVD description (English source)
A vulnerability was found in Ruijie RG-EW1200G 1.0(1)B1P5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/sys/set_passwd of the component Administrator Password Handler. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-236185 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.